To: 


Of: 


ICO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


DialADeal Scotland Ltd 


Unit 10, 70 Strathclyde Street, Glasgow, G40 4JR 


The Information Commissioner (“the Commissioner”) has decided to 
issue DialADeal Scotland Ltd (“DialADeal”) with a monetary penalty 
under section 55A of the Data Protection Act 1998 (“DPA 1998”). The 
penalty is being issued because of serious contraventions of 
Regulations 21 and 24 of the Privacy and Electronic Communications 
(EC Directive) Regulations 2003 (“PECR”). 


This notice explains the Commissioner's decision. 


Legal framework 


DialADeal, whose registered office is given above (Companies House 
Registration Number: SC609006), is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 


contrary to Regulations 21 and 24 of PECR. 
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Regulation 21 applies to the making of unsolicited calls for direct 


marketing purposes. Regulation 21 paragraph (1) of PECR provides 
that: 


"(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 


unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 


Under Regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified the 
Information Commissioner’s Office (“ICO”) that they do not wish, for 
the time being, to receive unsolicited calls for direct marketing 
purposes on those lines. The Telephone Preference Service Limited 
(“TPS”) is a limited company which operates the register on the 
Commissioner’s behalf. Businesses who wish to carry out direct 
marketing by telephone can subscribe to the TPS for a fee and receive 


from them monthly a list of numbers on that register. 


In general terms, Regulation 21 paragraph (1)(b) provides that 
companies cannot make unsolicited calls for direct marketing purposes 
to telephone numbers on the TPS register, unless the individual 
associated with the number has given their consent to receive such 


calls. 
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Regulation 21 paragraphs (2), (3), (4) and (5) provide that: 


"(2) A subscriber shall not permit his line to be used in contravention 


of paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 


(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under regulation 26 has notified 
a caller that he does not, for the time being, object to such calls 
being made on that line by that caller, such calls may be made by 
that caller on that line, notwithstanding that the number allocated 


to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at 


any time, and 


(b) where such notification is withdrawn, the caller shall not 


make such calls on that line.” 


Regulation 21 paragraph (A1) provides that companies making calls for 
direct marketing purposes must not disguise their identity. Paragraph 


(A1) states: 
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"A person shall neither use, nor instigate the use of, a public electronic 
communications service for the purposes of making calls (whether 


solicited or unsolicited) for direct marketing purposes except where 
that person— 


(a) does not prevent presentation of the identity of the calling 
line on the called line; or 


(b) presents the identity of a line on which he can be contacted.” 


Regulation 24 of PECR concerns the information which must be 
provided when, inter alia, a business makes marketing calls which 


Regulation 21 applies to. Regulation 24 provides, insofar as relevant: 


"(1) Where a public electronic communications service is used for the 
transmission of a communication for direct marketing purposes 
the person using, or instigating the use of, the service shall 
ensure that the following information is provided with that 


communication - 


(b) in relation to a communication to which regulation 
21 or 21A (telephone calls) applies, the particulars 
mentioned in paragraph (2)(a) and, if the recipient of 
the call so requests, those mentioned in paragraph 


(2)(b). 
(2) The particulars referred to in paragraph (1) are - 


(a) the name of the person; 
(b) either the address of the person or a telephone 


number on which he can be reached free of charge.” 
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Section 122(5) of the Data Protection Act 2018 (“DPA 2018”) defines 
direct marketing as “the communication (by whatever means) of any 
advertising material which is directed to particular individuals”. This 
definition also applies for the purposes of PECR (see regulation 2(2) 
PECR and paragraphs 430 & 432(6) to Schedule 19 of the DPA 2018). 


Consent in PECR is now defined, from 29 March 2019, by reference to 
the concept of consent in Regulation 2016/679 (“the GDPR”): 
regulation 8(2) of the Data Protection, Privacy and Electronic 
Communications (Amendments etc) (EU Exit) Regulations 2019. Article 
4(11) of the GDPR sets out the following definition: “'consent’ of the 
data subject means any freely given, specific, informed and 
unambiguous indication of the data subject's wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


Under section 55A(1) of the DPA 1998 (as applied to PECR cases by 
Schedule 1 to PECR, as variously amended), the Commissioner may 
serve a person with a monetary penalty notice if the Commissioner is 
satisfied that - 


“(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC Directive) 
Regulations 2003 by the person, and 
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(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 
(b) failed to take reasonable steps to prevent the contravention.” 


The Data Protection (Monetary Penalties) (Maximum Penalty and 
Notices) Regulations 2010 prescribe that the amount of any penalty 


determined by the Commissioner must not exceed £500,000. 


The Commissioner has issued statutory guidance under section 55C(1) 
of the DPA 1998 about the issuing of monetary penalties that has been 


published on her website. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 
overall aim of ensuring high levels of protection for individuals’ privacy 


rights. 


The provisions of the DPA 1998 remain in force for the purposes of 
PECR notwithstanding the introduction of the DPA 2018: see paragraph 
58(1) of Schedule 20 to the DPA 2018. 
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Background to the case 


DialADeal was incorporated on 25 September 2018. The Companies 
House listing records DialADeal as a “business and domestic software 


development” company. 


DialADeal first came to the attention of the Commissioner when 
complaints about unsolicited direct marketing calls during January 


2020 were reported by the TPS as being linked to a particular Calling 


Line Identifier (“CLI”): a. 


This CLI was investigated and found to not be in use, which led the 
Commissioner to conclude that it had been “spoofed”, which is to say 
that the number displayed to the recipient of the call had been 
disguised. With the co-operation of one of the complainants, the 
number was traced down via five Communication Service Providers 
CCSPs"): a 
D to DialADeal. 


From the information provided by MM, DialADeal was 
initially believed by the Commissioner to be another CSP in the chain 
rather than the end-user. As a result, the Commissioner contacted 
DialADeal on 3 March 2020 to request assistance in tracing the spoofed 


calls. 


DialADeal responded on 6 March 2020. It advised the Commissioner 


that it was unable to locate any calls relating to the relevant CLI and 
was pursuing the matter with the company’s CSP, aS. 


A third-party information notice (“3PIN”) was served on DialADeal on 
10 March 2020 requiring it to disclose the result of its enquiries with 
GE. o response to the notice was received from DialADeal 
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within the allotted 35 days, despite the 3PIN being ‘signed for’. An 


email reminder was sent on 21 April 2020. No reply was received. 


25. Following further investigation, the Commissioner determined that 
there was evidence to suggest that DialADeal was in fact the end-user 
of WY,» and not a CSP as previously suspected. 


26. On 29 April 2020, a 3PIN was sent to MM requesting 
information relating to DialADeal. MM responded on 18 May 
2020 with documentation which disclosed the following: 


e The CLI in question (MM) did relate to their subscriber 
DialADeal; 

° a cic not allocate CLIs to DialADeal, rather 
DialADeal and its clients were responsible for entering CLIs on its 
systems; 

e One of DialADeal’s company directors had made a “SIP Trunking 
Application”: to MM on 9 August 2019 confirming the 
trunking service would primarily be used for call centre traffic and 
“conversational PBX traffic”; 

e As part of the application, the director provided details of seven 
Internet Protocol (“IP”) addresses which would be used to 


connect to the MM trunking service. 


27. ete a also supplied Call Dialler Records (“CDRs”) for the 
period 11 August 2019 to 12 March 2020, for the calls attributable to 
DialADeal which passed through systems. These were 


analysed by the Commissioner and the results indicated that there 


! “SIP Trunking” is a method by which a user can make calls over a data connection. 
> “PBX” stands for Private Branch Exchange, which is a private telephone network used within a 
company to enable users to communicate internally and externally. 
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were 233 separate CLIs associated with calls made by DialADeal, of 


which 214 were ‘valid’ and 19 ‘invalid’. 


From the evidence provided it was apparent that between 11 August 
2019 and 12 March 2020 there had been a total of 1,376,255 calls 
made by DialADeal, with 558,250 of those connecting to subscribers 
who had been registered with the TPS for not less than 28 days at the 


time they received the call. 


Of the CLIs attributed to DialADeal, the Commissioner was able to 
identify that there were 314 complaints made to the TPS and 213 
complaints to the ICO between 11 August 2019 and 12 March 2020. 


Furthermore, the complaints which could be attributed to DialADeal 
suggested that the calls related to non-existent “Green Deal” energy 
saving schemes, including boiler and window replacement, loft 
insulation and home improvement grants. The complaints suggested 
that DialADeal had used several generic and untraceable trading names 
including, but not limited to, “First Home Improvements”, “Green 
Alliance”, “Green Allowance Team”, “Green Allowance Scheme”, 
“Green Funding Team”, “A1 Energysave”, “Boiler Funding Solutions”, 
“ECO Green UK”, and “Home Advice Group.” 


The following are examples of the complaints received about such calls 


by the TPS and the Commissioner: 


e “Man named I knew my name and said he was from the 
green allowance team and they are in our area at the moment 
and we may be eligible for money off home improvements under 


the green allowance scheme (sic).” 


e "Said they were a government department giving grants for 
insulation etc under the Government Green Deal (sic).” 
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e "They said they were from Home Advice Unit and that they were 
calling all the houses in the KY area to see if they were eligible 
for some home improvements after the recent bad weather (of 
which we have had none, incidentally). She asked me to confirm 
that I still lived at my address and I asked how she had my 
details. She said they were on a screen in front of her, but didn't 
know how they had been obtained. I asked her not to call again 


and hung up (sic).” 


e “Government funding for home energy. At this point I informed 
the caller that I was registered with TPS and they claimed they 
asked if I had updated TPS as it now has to be done annually. I 
then terminated the call and checked TPS is still valid on TPS 


website which it is (sic).” 


On 4 June 2020, the Commissioner applied to Companies House for 


disclosure of the home addresses of the two directors of DialADeal. 


On 8 October 2020, the Commissioner sent an initial investigation 
letter to the two directors at their home addresses, setting out her 
concerns about the organisation’s compliance with PECR, attaching 
details of all complaints, and requesting information about its business 


and marketing activities which would assist in her investigation. 


The Commissioner received confirmation that the letter to one of the 
directors was delivered and signed for. No such confirmation was 
received in relation to the second director. No reply was received to 


either letter. 


On 22 October 2020, Information Notices were sent to both directors at 
their home addresses, and to the company at its registered address 
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requesting information to assist with the Commissioner’s investigation. 


All three Notices were delivered and signed for on 23 October 2020. 


On 25 November 2020, Calum Kirkpatrick replied on behalf of both 


directors to advise that DialADeal had ceased trading. 


Following the earlier disclosure by EE of the IP addresses 
associated with DialADeal, a 3PIN was served by the Commissioner on 


RE 72 December 2020 


requesting the subscriber’s identity. 


The Commissioner sent a further email to the directors on 2 December 
2020, reminding them of their obligation to respond to the Information 
Notices, regardless of the current status of the company, and warning 


them of the consequences of failing to comply. 


In response, on 9 December 2020, Calum Kirkpatrick sent an email on 
behalf of both directors stating DialADeal was not responsible for 
initiating any of the calls detailed in the Information Notice. He added 
that DialADeal: 


e did not own or use any telephone numbers or CLIs; 

e did not use data to promote its business; 

e did not and had not made any unsolicited marketing calls and 
therefore did not require the use of TPS screening; 

e did not market itself; 

e did not possess marketing lists; 

e did not conduct any kind of marketing campaigns; 

e had no staff to train; 

e was not responsible for any complaints and was therefore unable 
to comment on them; 


e was happy to cooperate and answer further questions. 
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On 17 December 2020, in response to the Commissioner’s 3PIN of 1 
December 2020, (ME confirmed that the subscriber using six of 


the IP addresses on 9 August 2019 was Calum Kirkpatrick, a company 


director for DialADeal, who provided an email address 


Pee. In relation to the seventh IP address, no 


server under the IP address was active on the 09 August 2019. 
The Commissioner’s investigation was concluded at this point. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute a 
contravention of Regulations 21 and 24 of PECR by DialADeal and, if 


so, whether the conditions of section 55A DPA are satisfied. 
The contravention 


The Commissioner finds that Dial[ADeal contravened Regulations 21 and 
24 of PECR. 


The Commissioner finds that the contraventions were as follows: 


Between 11 August 2019 and 12 March 2020, DialADeal used a public 
telecommunications service for the purposes of making 558,250 
unsolicited calls for direct marketing purposes to subscribers where the 
number allocated to the subscriber in respect of the called line was a 
number listed on the register of numbers kept by the Commissioner in 


accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. 
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This resulted in 527 complaints being made to the TPS and the 


Commissioner. 


The Commissioner is also satisfied for the purposes of regulation 21 
that these 558,250 unsolicited direct marketing calls were made to 
subscribers who had registered with the TPS at least 28 days prior to 
receiving the calls, and they had not given their prior consent to 


DialADeal to receive calls. 


Further, DialADeal failed, as required by regulation 24 of PECR, to 
provide the recipient of the calls with the particulars specified at 
regulation 24(2) of PECR. Rather, DialADeal used various generic 
trading names (including “First Home Improvements”, “Green Alliance”, 
“Green Allowance Team”, “Green Allowance Scheme”, “Green Funding 
Team”, “A1 Energysave”, “Boiler Funding Solutions”, “ECO Green UK”, 


and “Home Advice Group”) and/or did not identify itself. 


When engaging in its direct marketing calls, DialADeal used not only a 
range of 214 valid CLIs, but also used 19 invalid presentation CLIs on 
which the recipients of the calls could not contact DialADeal. For these 
reasons, the Commissioner is concerned about DialADeal’s compliance 
with Regulation 21(A1) of PECR but has not sought to take specific 


enforcement action against it for this breach in this instance. 


The Commissioner notes DialADeal’s submissions towards the end of 
the Commissioner's investigation that it did not engage in any such 
direct marketing, however these claims are not borne out by the 


evidence provided by DialADeal’s CSP. 
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The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified above 
was serious. This is because there have been multiple breaches of 
Regulations 21 and 24 by DialADeal arising from the organisation’s 
activities over a seven-month period, and this led to 558,250 
unsolicited direct marketing calls being made to subscribers who were 
registered with the TPS and who had not provided valid consent. The 
Commissioner is further satisfied that there were a total of 527 
complaints between 11 August 2019 and 12 March 2020 for which 


DialADeal was culpable. 


Furthermore, DialADeal used presentation CLIs to prevent call 
recipients from contacting it. It also failed to identify itself on the calls 


and/or provided false generic company names. 


Many of the calls in question were simultaneously in breach of various 


PECR requirements. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate or negligent. 
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The Commissioner considers that in this case DialADeal did deliberately 


contravene regulations 21 and 24 of PECR. When reaching this finding 


she has given consideration to the following facts: 


a. It engaged in the direct marketing of ‘Government’ green 
schemes which do not appear to exist; 

b. There has been a high level of complaints; 

€. There is evidence that DialADeal used generic and 
untraceable names during its calls, in addition to the use of 
‘spoofed’ CLIs contrary to regulation 21(A1) PECR; 

d. The Company is not registered with the TPS and offered no 
evidence that it screened its calls against the TPS register; 

e. The company appears to have no internet presence which 
further hinders recipients of its calls from being able to 


contact it. 


Further and in the alternative, the Commissioner has gone on to 
consider whether the contravention identified above was negligent. 


This consideration comprises two elements: 


Firstly, she has considered whether DialADeal knew or ought 
reasonably to have known that there was a risk that this contravention 


would occur. She is satisfied that this condition is met. 


The Commissioner has published detailed guidance for companies 
carrying out marketing explaining their legal requirements under PECR. 
This guidance explains the circumstances under which organisations 
are able to carry out marketing over the phone, by text, by email, by 
post or by fax. Specifically, it states that live calls must not be made to 
any subscriber registered with the TPS, unless the subscriber has 
specifically consented to receive calls. The Commissioner has also 
published detailed guidance on consent under the GDPR. In case 
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organisations remain unclear on their obligations, the ICO operates a 
telephone helpline. ICO communications about previous enforcement 


action where businesses have not complied with PECR are also readily 


available. 


Standard practice of the TPS is to contact the organisation making the 
calls on each occasion a complaint is made. It is therefore reasonable 
to believe that DialADeal would have received a notification from the 
TPS for each of the complaints being made in this case. That there 
were 314 complaints made to the TPS alone over the period of the 
contravention should have made DialADeal aware of the risk that such 


contraventions may occur and were indeed occurring. 


It is reasonable to suppose that DialADeal should have been aware of 


its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether 
DialADeal failed to take reasonable steps to prevent the contravention. 


Again, she is satisfied that this condition is met. 


Reasonable steps in these circumstances may have included ensuring 
that it was only calling individuals for whom it had valid consent, or 
who were not registered with the TPS. To the contrary, DialADeal’s 
minimal engagement with the Commissioner suggests that it gave no 


regard to the privacy of those individuals whom it sought to contact. 


Given the volume of calls and complaints, it is clear that DialADeal 
failed to take any reasonable steps to prevent a contravention in this 


instance. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 
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The Commissioner’s decision to issue a monetar enalt 


The Commissioner has taken into account the following aggravating 


features of this case: 


DialADeal failed to co-operate with the Commissioner’s investigation; 


The actions of DialADeal were carried out to generate business and to 
increase profits, gaining an unfair advantage on those businesses 


complying with the PECR. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account the representations 
made by DialADeal on this matter. Within those representations, 
DialADeal apologised for “being naive with this matter in the past”, and 
accepted that it had “made mistakes”. DialADeal did not seek in its 
representations to challenge the Commissioner’s substantive findings 


as outlined in her Notice of Intent. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 
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The Commissioner has attempted to consider the likely impact of a 
monetary penalty on DialADeal. She notes that DialADeal has failed to 
file any company accounts since its incorporation in September 2018 
and its financial status is unknown. DialADeal was invited to provide 
financial representations, and evidence of financial hardship, in 
response to the Notice of Intent but failed to do so. The Commissioner 
considers in the circumstances that a penalty remains the appropriate 


course of action. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 
to reinforce the need for businesses to ensure that they are only 


telephoning consumers who want to receive these calls. 


For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £150,000 (One hundred and fifty 
thousand pounds) is reasonable and proportionate given the 
particular facts of the case and the underlying objective in imposing the 


penalty. 
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Conclusion 


The monetary penalty must be paid to the Commissioner's office by 
BACS transfer or cheque by 24 September 2021 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
23 September 2021 the Commissioner will reduce the monetary 
penalty by 20% to £120,000 (one hundred and twenty thousand 
pounds). However, you should be aware that the early payment 


discount is not available if you decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 
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e the period specified within the notice within which a monetary 


penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


82. In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 24t" day of August 2021. 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2; If you decide to appeal and if the Tribunal considers:- 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that she ought to have exercised 


her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3: You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 
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Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state:- 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

C) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 


notice of appeal must include a request for an extension of time 
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and the reason why the notice of appeal was not provided in 


time. 


5, Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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